CVE-2021-43774 Weak cryptography in n/a
Attackers with admin access can decrypt stored user passwords using weak ciphers like ROT13, leading to credential theft and potential account takeover.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-43774?
CVE-2021-43774 is a medium-severity vulnerability in n/a, published on 3 Mar 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A risky-algorithm issue was discovered on Fujifilm DocuCentre-VI C4471 1.8 devices. An attacker that obtained access to the administrative web interface of a printer (e.g., by using the default credentials) can download the address book file, which contains the list of users (domain users, FTP users, etc.) stored on the printer, together with their encrypted passwords. The passwords are protected by a weak cipher, such as ROT13, which requires minimal effort to instantly retrieve the original password, giving the attacker a list of valid domain or FTP usernames and passwords.
Weakness: CWE-327
Which versions are affected by CVE-2021-43774?
It affects 160 products.
Products include Fujifilm Apeosport-Iv 2060 Firmware, Fujifilm Apeosport-Iv 3060 Firmware, Fujifilm Apeosport-Iv 3065 Firmware, Fujifilm Apeosport-Iv 3070 Firmware, Fujifilm Apeosport-Iv 4070 Firmware, Fujifilm Apeosport-Iv 5070 Firmware and 154 more.
How do I fix CVE-2021-43774?
No fix has been published for CVE-2021-43774 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-43774 being exploited?
There is no known exploitation of CVE-2021-43774 in the wild and no public exploit code.
Sources
Also known as GHSA-7jxq-9xcf-r6rg.